The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and set the end position to read_buf + READ_BUFFER_SIZE.
Fixes: b5c84a9edcd418 ("drm/bridge: add it6505 driver") Reported-by: Mark Brown broonie@kernel.org Signed-off-by: Hsin-Yi Wang hsinyi@chromium.org --- drivers/gpu/drm/bridge/ite-it6505.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c index fb16a176822d81..f2f101220ade94 100644 --- a/drivers/gpu/drm/bridge/ite-it6505.c +++ b/drivers/gpu/drm/bridge/ite-it6505.c @@ -289,7 +289,7 @@ #define WORD_LENGTH_20BIT 2 #define WORD_LENGTH_24BIT 3 #define DEBUGFS_DIR_NAME "it6505-debugfs" -#define READ_BUFFER_SIZE 200 +#define READ_BUFFER_SIZE 400
/* Vendor option */ #define HDCP_DESIRED 1 @@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf, struct it6505 *it6505 = file->private_data; struct drm_display_mode *vid = &it6505->video_info; u8 read_buf[READ_BUFFER_SIZE]; - u8 *str = read_buf, *end = read_buf + PAGE_SIZE; + u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE; ssize_t ret, count;
if (!it6505)
On Mon, 28 Feb 2022 at 09:14, Hsin-Yi Wang hsinyi@chromium.org wrote:
The size of read_buf is READ_BUFFER_SIZE (200), so we can't access it with read_buf + PAGE_SIZE (4096). Extend the READ_BUFFER_SIZE to 400 and set the end position to read_buf + READ_BUFFER_SIZE.
Fixes: b5c84a9edcd418 ("drm/bridge: add it6505 driver") Reported-by: Mark Brown broonie@kernel.org Signed-off-by: Hsin-Yi Wang hsinyi@chromium.org
drivers/gpu/drm/bridge/ite-it6505.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c index fb16a176822d81..f2f101220ade94 100644 --- a/drivers/gpu/drm/bridge/ite-it6505.c +++ b/drivers/gpu/drm/bridge/ite-it6505.c @@ -289,7 +289,7 @@ #define WORD_LENGTH_20BIT 2 #define WORD_LENGTH_24BIT 3 #define DEBUGFS_DIR_NAME "it6505-debugfs" -#define READ_BUFFER_SIZE 200 +#define READ_BUFFER_SIZE 400
/* Vendor option */ #define HDCP_DESIRED 1 @@ -3074,7 +3074,7 @@ static ssize_t receive_timing_debugfs_show(struct file *file, char __user *buf, struct it6505 *it6505 = file->private_data; struct drm_display_mode *vid = &it6505->video_info; u8 read_buf[READ_BUFFER_SIZE];
u8 *str = read_buf, *end = read_buf + PAGE_SIZE;
u8 *str = read_buf, *end = read_buf + READ_BUFFER_SIZE; ssize_t ret, count; if (!it6505)-- 2.35.1.574.g5d30c73bfb-goog
Reviewed-by: Robert Foss robert.foss@linaro.org
dri-devel@lists.freedesktop.org
-
Hsin-Yi Wang -
Robert Foss